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(U) This module will enable you to: 

• (TS//SI//NF) Recognize the direct relationship between the Foreign Powers and 
establishing RAS 
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• (TS//SI//NF) Identify the key components of RAS and how it is applied to candidate 
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(U) Present learning objectives in the travel 
journal 


• ( 1 b//SI//NI ) Identity who can adjudicate and approve a KAS nomination 

• (TS//SI//NF) Recognize the requirement associated with identifiers linked to U.S. 
persons - the OGC First Amendment Review 

• (TS//SI//NF) List common sources of information used to construct a RAS 
nomination statement 



(TS//S I //NF) (OGC Attorney): This part of our trip wiii provide you with an overview of the Reasonabie Articuiabie Suspicion (RAS) Standard inciuding 
definitions and descriptions to heip you understand how to satisfy RAS and how to appiy it to identifiers under the BR and PR/TT FISC Orders. In addition 
to this training, guidance is aiso outiined in a RAS memo that can be obtained from the Office of Generai Counsei. 



(TG//3 I //Nf ) This moduie wiii enabie you to: 

• f FO/ZG I Z/NF) - Recognize the direct reiationship between the Foreign Powers and estabiishing RAS 

• (TSZZS I ZZNF) Identify the key components of RAS and how it is appiied to candidate identifiers 
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• (TS//S I //Nt F) Identify who can adjudicate and approve a RAS nomination 

• (TS//S I //N F)- Recog n ize the requirement associated with identifiers iinked to U.S. persons - the OGC First Amendment Review 

• tTG//G I //NF ) List common sources of information used to construct a RAS nomination statement 

(TS//S I //N F) At the conciusion of this moduie you shouid understand that an identifier must be RAS-approved before conducting a query. The topic of 
querying BR and PR/TT buik metadata wiii be discussed in Moduie 4. 
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4- TS//S I //N F) Who can be targeted under the BR and PR/TT authorities? 
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■ {TS//S I //N F) NSA is not permitted to query the BR and PR/TT metadata unless there is a 



GRAPH IC/AV: 

(U) Insert graphics/animations to illustrate 
the umbrella groups and their affiliated 
terrorist organizations 
(U) Add graphics to illustrate contact 
chaining, seeds, and hops. 



reasonable articulable suspicion that the identifier is associated with one of the 
approved groups. 



FISC- 




enmittedjo target under each authority. 

The Orders list in great detail | 

NSA is not permitted to query the BR and PR/TT metadata unless there 



is a reasonable articulable suspicion that the identifier is associated with one of the FISC-approved groups. 



(TS//S I //NF) It is important to note that you cannot query using just anWorgiamntelliaenc^arae^urthemTore^oL^anno 
taroe^foi^AN however query 

named in the Orders. Note that the lists may evolve and your target may be added or removed over time, so you should reference the 
most current version of the lists for updates. 



TOP SECRET//SLWOFORN 
Page 3 of 17 




TOP SECRETZ/SLWOrORN 



DATE/PREPARER: 11/09/2010 SLS 



Topic 

(U)What is RAS? 



Home 



Page Classification 

TOP SECRET//COM I NT//NOrOR N- 



Exit 



Glossary 



Screen Number 
3 of 13 



Back 



Next 



FRAME ID: 3030 



(U) What is Reasonable Articulable Suspicion (RAS)? 



NEXT FRAME ID: 3035 



BACK FRAME ID: 3020 
ALT TAG: 

GRAPH IC/AV: 



(U) Reasonable Artieulable Suspicion (RAS) Standard 

(TS/ZSI/j^lF )- An identifier will meet the Reasonable Articulable Suspicion Standard if based on 
the factual and practical considerations of everyday life on which reasonable and prudent 
persons act, there are facts giving rise to a reasonable articulable suspicion that the identifier is 
associated with one of the specified Foreign Powers. 

- Foreign Intelligence Surveillance Court 



(U) Display pop-up with the definition of 
RAS as it is discussed. 



(TS//SI//fvlF) (OGC Attorney): The FISC recognizes the potential counterterrorism advantage gained through analysis of the BR and PR/TT bulk metadata; 
however, because there is a great deal of U.S. person information included in the bulk metadata, the FISC has set strict guidelines on when and how 
analysts can access the metadata under these authorities. The RAS standard is one of these guidelines which helps to provide reasonable assurance that 
only legitimate terrorism-related identifiers are used to query the bulk metadata. This standard must be met before queries can be conducted. 

(TS//S I //NF ) So what is RAS? RAS is a legal standard that describes the measure of proof required to support a decision whether to permit an identifier to 
be queried from the bulk metadata. The Reasonable Articulable Suspicion standard requires just that-a suspicion that you can explain in a reasonable way. 
It does not require certainty, but is more concrete than a simple hunch. It may be easiest to think of it in terms of other standards with which you may be 
familiar. 



"(TS//OI//Nr-) Many of you may be familiar with legal standards of proof applicable in other situations. It may be helpful to understand how the RAS standard 
compares to these other legal standards. For example, a jury in a criminal case will not convict an accused unless the evidence of guilt is ’’beyond a 
reasonable doubt. “This is the highest legal standard of proof. A jury in a civil case (such as a personal injury case or a contract dispute) might award a 
plaintiff money damages if the plaintiff proves the elements of his claim by ’’a preponderance of the evidence.” This standard is lower than ’’beyond a 
reasonable doubt.” Lower still is the standard of proof required to justify issuance of a search warrant - ’’probable cause” - whether that search warrant is 
for the suspect’s home or the content of the suspect’s communications. The RAS standard falls below ’’probable cause.” 
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. (TS//S I //NF) The FISC has determined that this iower standard of proof is reasonabie for the querying of metadata because communications metadata 
does not carry with it the same privacy protections as communications content. The RAS standard faiis beiow ’’probabie cause” but above a mere hunch or 
guess. 
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(U) The RAS Equation 

(U) (Continue to dispiay definition of RAS then puii out the RAS Equation.) 
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Reasonable Artieulable Suspicion (RAS) Standard 

fF S//SLWr) An identifier will meet the Reasonable Articulable Suspicion Standard if based on 
the factual and practical considerations of everyday life on which reasonable and prudent 
persons act, there are facts giving rise to a reasonable articulable suspicion that the identifier is 
associated with one of the specified Foreign Powers.” 

- Foreign Intelligence Surveillance Court 
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(U) Continue to display definition of RAS 
then pull out the RAS Equation. 



RAS Equation 

Identifier + Link to Foreign Power = RAS 



(TS//S I //NF) (OGC Attorney): As it applies to the B R and PR/TT Orders, RAS is a suspicion that an identifiej^uct^^r^mai^ddrassAeleohon^T^ 
or other identifier type, is associated with one of the^|Foreign Powers named in BR and PR/TT Orders 

FISC requires that NSA base that suspicion on a certain level of factual evidence -- and NSA must articulate those facts that connect the identifier with one 
of the named terrorist organizations. The requirement that these facts be articulable effectively provides reasonable assurance that analyst queries of the 
metadata are based on substantive information (meaning more than simple hunches or uninformed guesswork). So in order to obtain RAS approval for an 
identifier, analysts must provide enough factual evidence that it would lead a reasonable person to suspect that an identifier is associated with one of the 
named Foreign Powers in the BR and PR/TT Orders. We will get more into the kinds of facts that may be used and how they can support a RAS 
nomination later in this module. 

~( TG//0 I //Nr) In summary, based on the factual and practical considerations of everyday life 
detenmin^^hei^^^iaasora suspicion that the identifier is associated with [ 

in the Orders. There must be at least one qualifying fact giving rise to the suspicion that the identifier is associated 
with one of the Foreign Powers listed in the BR and PR/TT Orders. Unless that determination is made, the identifier cannot be approved to query this 
metadata repository. NSA’s implementation of the BR and PR^^Orders mandates that the RAS nomination statement must clearly link the identifier/target 
to one of the Foreign Powers and document this finding which will be discussed later in the module. 
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^ I ) ^niviu unaracier;: rrom an Mnaiysis ana rrooucuon sianopoini, leis iook ai Krto in me coniexi oi me anaiysi levei oi enori requireo lo uimze 

BR and PR/TT and other SIGINT authorities. As the iiiustration shows, the ievei of effort required by an anaiyst to estabiish RAS wouid normaiiy be 
considered iess than that required for FBI CT FISA or FAA 704/705b, but it is more than what is needed to utiiize E.O. 12333, for exampie. 
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(U) Who can make a RAS determination? 

• (U// FOUO) Homeland Mission Coordinators (HMCs) 

• (U/ /FOUO) Chief of the CT Homeland Security Analysis Center 

• (U// FOUO) Deputy Chief of the CT Homeland Security Analysis 
Center 

(U) No one else can make this determination! 



fTS/ZOIZ/NF-) (OGC Attorney): The FISC states that the RAS decision is based on considerations of “reasonabie and prudent persons.” This does not, 
however, mean that anyone can approve an identifier for RAS. There are a seiect number of peopie within NSA who have been given the authority to 
approve identifiers for querying under these two authorities. Those individuais are caiied Homeiand Mission Coordinators or HMCs. 



( TS/ZS I Z/NF) (HMC Character): As was just mentioned, RAS determinations are typicaiiy made by speciaiiy trained personnei in the Office of 
Counterterrorism and its Extended Enterprise; these individuais are titied Homeiand Mission Coordinators, typicaiiy abbreviated as HMCs. These 
individuais, iike me, have been given speciai training on how to appiy the RAS standard and how to appiy it consistentiy. HMCs are speciaiiy trained 
individuais who have extensive experience working with this target set and who have extensive experience working with these authorities. The HMCs can 
take a RAS nomination, review the facts, and make a determination as to whether or not that particuiar identifier meets the RAS standard. 



(TS//S I //N F)- (HMC Character): According to the BR and PR/TT Orders, in addition to the HMCs, the Chief and Deputy Chief of the Counterterrorism 
Homeiand Security Anaiysis Center are authorized to make a RAS determination; aithough, it is generaiiy the HMCs who make the RAS determinations. To 
reemphasize, no one eise is authorized to make RAS determinations according to the Orders. 
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(U) First Amendment Rights 

• Religion 

• Speech 

• The press 

• Peaceable assembly 

• To petition the government for redress of grievances 



Screen Number 
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Next 



trS//OI//NF) (HMC Character): There are certain identifiers that require an extra RAS review/approvai step. As you might imagine, those are the identifiers 
that are reasonabiy beiieved to be used by U.S. persons. Why does this matter? It matters because the U.S. Government is forbidden from regarding a 
U.S. person as associated with a Foreign Power soieiy because he or she is exercising his or her First Amendment rights. 

(TS//S I //NF) ( OGC Attorney): That’s right. Any identifier beiieved to be used by a U.S. person must be forwarded to the OGC by a Homeiand Mission 
Coordinator foiiowing his or her approvai. An OGC attorney wiii review the RAS nomination, as weii as the RAS decision made by the Homeiand Mission 
Coordinator, and make a determination as to whether or not NSA is targeting that individuai based soieiy on activities that are protected by the First 
Amendment to the Constitution. If there is any indication that the RAS is based soieiy on information or evidence protected somehow by the First 
Amendment, CGC wiii require additionai information to support the RAS nomination. 



(TS//S I //N F) (HMC Character): If you are an analyst, should you abandon a RAS nomination if there is a potential First Amendment concern? Absolutely 
not. The presence of First Amendment evidence does not invalidate a RAS, it just cannot be the sole basis for a nomination. The CGC review is really 
transparent to the analyst, though it is a part of the process that you should be aware of. 
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(U) What sources of information can be used to justify RAS? 
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^1 ri^A. uraers 
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• Existing FISA Orders 




• Federal Bureau of Investigation documents 






• Central Intelligence Agency documents 


TTST/SiZ/NTf)- Reports and/or RAW 




• National Counterterrorism Center 


SIGINT 




documents 






• Documents from other U.S. Government 


• SIGINT reports 




Organizations 


• FISA surveillance data derived from other 




• Foreign Partner nations 


authorized targets 




• Public records available on the 


• Raw SIGINT (after a Reporting Source 




internet, newspapers, or other public 


Validation Check) 




resources 


• SIGDEV Work 






• Other transcripts 





XTS//SI//NF) (HMC Character): So now let’s look at the type of evidence that can be used to justify RAS. NSA can use any information that is lawfully in our 
possession. A published SIGINT report describing the results of electronic surveillance of a target might be more reliable than say pocket litter found during 
a detainee’s interrogation -- but NSA can rely on any lawfully held evidence. The HMCs are responsible for assessing the quality and reliability of the 
evidence. 



(T0//S I //NF ) (OGC Attorney): Sources that are often used to justify a RAS nomination include, but are not limited to: 

• Existing FISA Orders 

• SIGINT reports 

• FISA surveillance data derived from other authorized targets 

• SIGINT traffic, as long as the submitting analyst has performed a Reporting Source Validation Check 

• SIGDEV work (with verified sources), and 

• Other transcripts 




If an analyst/requestor uses unpublished query results in a RAS justification, and they classify the material appropriately as 



then that information will only be visible to those I 



lusers with 



I credentials, as confirmed 
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(TS//S I //NF) (OGC Attorney): The following 1C and public sector (open source) sources are also examples of sources that are frequently used: 

• Federal Bureau of Investigation (FBI) documents 

• Central Intelligence Agency (CIA) documents 

• The National Counterterrorism Center (NCTC) documents 

• Documents from other U.S. Government Organizations 

• Foreign Partner nations, and 

• Public records available on the internet, newspapers, or other public resources. 
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• (TS//S I //NF) Supports the Homeland Defense Counterterrorism (CT) Mission. 

• (TS//S I //NF ) Provides the ability to request, justify, review, approve/disapprove RAS 
nominations/requests. 

• (TS//S I //NF) Is the authoritative source for the list of RAS-approved identifiers and will export that list to 
other systems that require it. 

• (TS//S I //N F) Provides metrics and other information to facilitate oversight review and report generation for 
the Department of Justice (DOJ) and the FISC. 

(U) Time Bounded Approvals 



(- TS//S I //NF ) (HMC Character): Remember from earlier in this module, we introduced the RAS process as a simple equation: identifier + link to Foreign 
Powers = RAS. Now you may be wondering how an identifier is nominated for RAS. NSA must demonstrate and document that ev^^^^^^r used to 
query the bulk metadata meets the RAS standard PRIOR to querying the BR and PR/TT bulk metadata repositories. NSA created the RAS 
identifier management tool, to streamline the adjudication of the RAS nomination statements and documentation of RAS determinations. 



(TS//S I //NF ) (HMC Character): Typically, an intellig|enc^nal^t will gather the necessary information and draft the nomination statement in IRONMAN 
articulating the RAS equation. An HMC, also usino^^^^^H will review the nomination statement and approve or disapprove the request. If the 
nomination statement is for a U.S. person, the^^^^^|tool includes functionality that allows the HMCs to forward such requests to OGC for the required 
First Amendment review. In either case, if the RAS nomination is approved, the identifier is now authorized for querying. 



t TO/ZO I Z/NF ) (OGC Attorney): Through 
IRONMAN provides the ability to 
of RAS-approved identifiers, and 





NSA documents all RAS-approved identifiers, 
ify, review, approve/disapprove RAS nominations, 
[exports that list to other systems that require it. 




ithe rationale used to gain RAS approval, 
is therefore the authoritative source for the list 



(TS//S I //NF ) (OGC Attorney): It is important to remember that copies of the documents, such as court orders or reports, are required as part of the 
nomination process. The paper trail should enable an auditor from Department of Justice (DOJ) to clearly evaluate all of the evidence presented to support 
a RAS decision. 
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(TS//S I //NF) (OGC Attorney): NSA has overseers, specifically the DOJ National Security Division attorneys, who examine the factual support for our RAS 
decision process. They take a look at any notes that the HMCs or someone within the NSA OGC may have included, and they decide whether or not we 
have properly applied the RAS standard to all of the identifiers that are used to query the bulk metadata. So it is critical that we take great c arg throughou t 
the process, gathering and presenting the evidence and applying the RAS standard in a consistent manner across all identifier nominations. p 
also provides metrics and other information to facilitate this oversight review and report generation for the DOJ and the FISC. 



(TS//S I //N F) (OGC Attorney) The Court recognizes that occasionally, NSA may have information suggesting that a target may have used a particular 
identifier only for a limited time. In such cases, an HMC can determine that the RAS standard is met for the specifi^imeframe that the identifier was 
believed to be used by the target. Such instances are considered Time Bounded and are uniquely dealt with in Analysts encountering targets 

under these circumstances should consult with an HMC on how to proceed. 
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■ {TS//S I //NF) Although a RAS determination for an identifier reasonably believed to be 
used by a United States person is legally effective for 180 days, NSA CT has 
implemented guidance that requires RAS review/re-approval every 90 days. 

( TS//S I //N - F ) After the sunset of an identifier’s RAS approval - or anytime before - the 
identifier can be submitted for RAS revalidation through the same process. 



(U) (Show passing of time and then a 
graphic of an identifier with a “RAS- 
APPROVED” or “DENIED” applied over the 
identifier) 



(TS//S I //N F) (HMC Character): RAS approvals have sunset or expiration dates which analysts must comply with. Currently a RAS approval on a foreign 
identifier, per the FISC, is legally valid for one year. However, NSA CT has taken a conservative approach and implemented guidance that mandates RAS 
review and re-approval every 180 days. Likewise, a RAS approval for an identifier believed to be used by a U.S. person has a legal lifespan of 180 days 
per the FISC, but NSA CT has implemented guidance requiring review and re-approval every 90 days. It is the analyst’s responsibility to monitor the sunset 
dates and take appropriate actions before the RAS nomination expires. 



(TS//S I //NF ) (HMC Character): Any identifier can be resubmitted for revalidation at any time. Revalidations require proof of the same categories of 
information that was required for the original request. Revalidations should try to validate that the original evidence is still true by presenting any new 
documentation to demonstrate that the identifier is still associated with the Foreign Powers named in the Orders. It is up to the HMCs to make an informed 
revalidation, based on the totality of the evidence. If you are uncertain of your evidence, submit the nomination anyway and work with the HMCs through 
the process. 
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1. ( TS//S I //N F) Why is the link between the target and the Foreign Powers an essential part of the RAS 
nomination? 

a) (TG//G I //NF) It is a key component in reaching the ‘probable cause' standard 

b) (TS//SI//NF) It is representative of the terrorist centric scope of the BR and PR/TT authorities 
as noted in the FISC Orders 

c) (U) Because it is required by USSID SP0018 and DoD 5240. 1-R 

d) (U) Because it is required in a DIRNSA Memo 



2. (TS//S I //NF ) The RAS standard requires that what two facts are articulable? 

a) ( TS//S I //Nr) The identifier can be tied to a terrorist target and that target can be tied to 



b) 

c) 

d) 



(TS//SI//NF) The identifier is not used by a U.S. person and they are engaged in terrorist 
activities 

fT3//3l//r4F) The identifier can be tied to a target and that target is affiliated with^^^^| 



i^ue^Tar^^facecreaano the analyst who submitted it and the identifier is 
associated with any terrorist group. 



(U) (HMC Character): Let’s check what you remember from this topic! 



ANSWERS: 

Question 1 : ff G//3 l //N F) Correct! The link between the target and the Foreign Powers is an essential part of the RAS nomination because it is 
representative of the terrorist centric scope of the BR and PR/TT authorities as noted in the FISC Orders. 

(TS//SI//NF) Incorrect. The correct answer is b). The link between the target and the Foreign Powers is an essential part of the RAS nomination because it 
is representative of the terrorist centric scope of the BR and PR/TT authorities as noted in the FISC Orders. 



Question 2: (TS/ZS I Z/NF) Correct! The RAS standard requires that the following two facts are articulable: 

• The identifier can be tied to a terrorist target, and 

• That target can be tied to | 

(T3//3I//NF) Incorrect. The correct answer is a). The RAS standard requires that the following two facts are articulable: 

• The identifier can be tied to a terrorist target, and 

can be to 
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3. (TS//SI//NF) Who may make a RAS determination? 

a) (TS//S I //NF) A Homeland Mission Coordinator (HMC) or an attorney with the Department of 
Justice 

b) (TS//S I //Nr ) An HMC or other official named in the Orders 

c) (TG//G I //NF -) Any reasonable and prudent analyst (and OGC if identifier is believed to be used by 
a U.S. person) 

d) (TS//S I //NF) Only a judge from the FISC 

4. (TG//G I //NF ) Which source of information may be used to justify RAS? 

b) ( TS//S I //N P)Open source information 

c) (T S//S I //NF) Second Party reports 

d) (TS//S I //Nr ) All of the above 



5. (TS//S I //N P) What additional requirement is needed for an identifier reasonably believed to be used by a 
U.S. person? 

a) ( TS//S I //NF ) Must be reviewed by the Attorney General 

b) ( TS/ZS I Z/NF) Must be reviewed by the Chief of the Homeland Security Analysis Center 

c) ( T S /Z SI Z/NF) Must be reviewed by OGC 

d) (TSZ/S I ZZN F) Two HMCs must agree on the RAS determination 



(No audio or transcript on this page) 



Question 3: (T G/ZG I Z/NF ) Correct! An HMC or other official named in the Orders may make a RAS determination. 

( TS/ZS I Z/NF) incorrect. The correct answer is b). An HMC or other official named in the Orders may make a RAS determination. 

Question 4: (TSZ/S I ZZN F) Correct! SIGINT reports, open source information, and Second Party reports may all be used to justify RAS. 

(TS/ZSIZ/NF) incorrect. The correct answer is d). SIGINT reports, open source information, and Second Party reports may all be used to justify RAS. 

Question 5: (TSZ/StZ/NF) Correct! If an identifier is reasonably believed to be used by a U.S. person, then it must be reviewed by QGC. 

(TS/ZS I Z/NF) Incorrect. The correct answer is c). If an identifier is reasonably believed to be used by a U.S. person, then it must be reviewed by QGC. 
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(U) Now that we have completed this part of your trip you should be able to: 

• (-TS//SI//NF) Recognize the direct relationship between the Foreign Powers and 
establishing RAS 

• (TS//SI//NF)- Identify the key components of RAS and how it is applied to candidate 
identifiers 

• (TS//SI//NF) Identify who can adjudicate and approve a RAS nomination 
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persons - the OGC First Amendment Review 

. (TS//SI//NF) List common sources of information used to construct a RAS 
nomination statement 


ALT TAG: 
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(U) Review iearning objectives in the travei 
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(TS//SI//NF) (HMC Character): So remember, RAS nominations are approved by an HMC (or an officiai named in the Order) BEFORE queries can be 
made using a particuiar identifier within the BR or PR/TT metadata. 



(U) (OGC Attorney): Now that we have compieted this part of the trip you shouid be abie to: 

• (TO//O I //f^t P) Recognize the direct reiationship between the Foreign Powers and estabiishing RAS 

• (T- S//S I //N F) Identify the key components of RAS and how it is appiied to candidate identifiers 

• (TS//SI//NF) Identify who can adjudicate and approve a RAS nomination 

• (TS//S I //NF) Recognize the requirement associated with identifiers iinked to U.S. persons - the OGC First Amendment Review 

• (TS//3I//NF) List common sources of information used to construct a RAS nomination statement 
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